Qwen3Guard: Real-Time Safety for Token Streams

Qwen3Guard is the Qwen family's first safety guardrail model. It fine-tunes the Qwen3 foundation model for safety classification to precisely judge the risk level of prompts and responses. It shows strong performance across English, Chinese, and multilingual settings, and supports both prompt classification and response classification.

Two variants are provided.

• Qwen3Guard-Gen: a generative model that takes the full user prompt and model response as input and classifies their safety. It is well-suited for offline safety annotation, dataset filtering, and safety-based reward for RL.
• Qwen3Guard-Stream: a streaming model that evaluates safety token-by-token while a response is being generated. It attaches two lightweight classification heads to the final layer, performing low-latency moderation concurrently with generation.

The classification scheme has three levels: Safe / Unsafe / Controversial. This is more flexible than a simple binary classification—Controversial can be reinterpreted as Safe or Unsafe depending on the application, and it responds more robustly to different dataset criteria.

Coverage is also broad. It covers 119 languages and dialects, and aims for consistent safety performance across both prompts and responses. It is offered in 0.6B, 4B, 8B sizes, so it can be chosen to fit deployment environments and resource constraints.

There are two main ways to use it.

• Qwen3Guard-Gen for dataset moderation, offline labeling, and generating RL safety signals
• Qwen3Guard-Stream for real-time intervention and safety blocking during LLM response generation

The models are released on Hugging Face and ModelScope, and Qwen3Guard technology is also applied to the Alibaba Cloud AI Guardrails service. The core idea is to provide more flexible moderation at both the training stage and the inference stage for safe AI interaction.